@bonesofspring/ai-rules 0.2.11 → 0.2.12

package/presets/cursor/php-laravel/rules/preset-no-cross-stack-leakage.mdc

@@ -0,0 +1,69 @@
+---
+description: Preset authoring meta-rule (preset-no-cross-stack-leakage)
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-no-cross-stack-leakage.md -->
+
+# Preset no cross-stack leakage
+
+Запрет протекания stack-specific имён, путей и handoff stems между пресетами.
+
+## Principles
+
+- `next` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `ios-swift` must not ship Playwright handoffs or Next lint recipes as required commands.
+- `go` / `java` / `php-hexagonal` / `php-laravel` / `mcp-ts` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
+- `mcp-ts` must not ship Go tool commands (`go test`, `go vet`, `golangci-lint`) or `integration-test-*` agents as required delivery gates.
+- Shared core must not embed stack paths (`app/src/**`, `Features/**`, `playwright`, `xcodebuild`).
+
+## Forbidden in ios-swift hooks/agents (FAIL)
+
+In ios-swift `chain-team-phases.sh` / agent handoffs (Cursor + Claude):
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`
+- `app/__tests__/e2e` as a required path
+- Positive yarn recipes `lint:js` / `lint:css` as commands to run (negation prose alone is weak — prefer zero occurrences)
+
+Required instead: `xcuitest-test-*` stems; build-verifier mentions `xcodebuild` or `post-change-build` / `xcode-tooling`.
+
+## Forbidden in next hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for Next app work
+
+## Forbidden in go / java / php-hexagonal / php-laravel hooks/agents (FAIL)
+
+Shared backend-stack bans (`go`, `java`, `php-hexagonal`, and `php-laravel`):
+
+- `playwright-test-`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
+- Positive yarn recipes `lint:js` / `lint:css`
+- `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
+- Agent file `accessibility-reviewer` (no UI surface)
+
+Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`), `java-tooling` (`mvn test` / `./gradlew test`), or `php-tooling` (`php artisan test` / `composer test` / `vendor/bin/phpunit`).
+
+## Forbidden in mcp-ts hooks/agents (FAIL)
+
+Same UI/mobile bans as backend stacks, plus:
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
+- Positive yarn recipes `lint:js` / `lint:css` as required gates
+- `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
+- Go tool commands as required MCP delivery gates: `go test`, `go vet`, `golangci-lint`
+- Agent files: `playwright-test-*`, `xcuitest-test-*`, `integration-test-*`, `accessibility-reviewer`
+
+Required instead: package-manager–discovered typecheck/test (`mcp-ts-tooling`, `post-change-test`); Phase 1 gates `build-verifier` + `security-reviewer`.
+
+## Soft / document
+
+- Mentioning the other stack in **docs** comparing presets is OK.
+- `build-verifier` may reference other stacks when validating **preset packaging** (`scope: preset-structure-validation`).
+
+## Chain fork
+
+`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `ios-swift`, `go`, `java`, `mcp-ts`, `php-hexagonal`, and `php-laravel` (per platform).

package/presets/cursor/php-laravel/rules/preset-pr-checklist.mdc

@@ -0,0 +1,39 @@
+---
+description: Preset authoring meta-rule (preset-pr-checklist)
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-pr-checklist.md -->
+
+# Preset PR checklist
+
+Чеклист для PR, затрагивающих `packages/ai-rules/presets/**` (и dogfood `.cursor/` sync).
+
+## Before merge
+
+- [ ] **SoT:** правки в `packages/…` (не только root `.cursor/`)
+- [ ] **Core:** если менялся `_shared/core/**` — обновлены все `<!-- shared-core: … -->` consumers (или documented intentional fork)
+- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, ios-swift, go, java, mcp-ts, php-hexagonal, and php-laravel — см. `preset-twin-sync`)
+- [ ] **Mapping:** `claude/<stack>/rules/README.md` mapping table актуален
+- [ ] **Token budget:** alwaysApply / session-start ≤ 3; meta rules not always-on
+- [ ] **Leakage:** нет чужих stack agent stems / handoff strings (`preset-no-cross-stack-leakage`)
+- [ ] **Twin depth:** domain ≥15 lines; thin aliases documented
+- [ ] **README:** stack `rules/README.md` core→stack mapping / catalog updated if stems added
+- [ ] **CHANGELOG / package README:** note when public preset paths or install surface change
+- [ ] **Dogfood:** run `packages/ai-rules/scripts/sync-dogfood-cursor.sh` (or document intentional skip) when maintaining this monorepo
+- [ ] **shared-core drift:** for embed-mode stems, run `packages/ai-rules/scripts/check-shared-core-drift.sh` (or document intentional fork)
+
+## Pointers
+
+- Layering: `preset-layering`
+- Sync: `preset-twin-sync`
+- Budget: `preset-token-budget`
+- Leakage: `preset-no-cross-stack-leakage`
+- Validation: stack `agents/build-verifier.md` → preset-structure section
+- Dogfood script: `packages/ai-rules/scripts/sync-dogfood-cursor.sh`
+- Drift script: `packages/ai-rules/scripts/check-shared-core-drift.sh`
+- Orchestrator: when editing presets, load this checklist + twin-sync

package/presets/cursor/php-laravel/rules/preset-token-budget.mdc

@@ -0,0 +1,41 @@
+---
+description: Preset authoring meta-rule (preset-token-budget)
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-token-budget.md -->
+
+# Preset token budget
+
+Инварианты загрузки правил в **установленном** пресете (consumer app).
+
+## Hard caps
+
+| Platform | Always-on | Cap |
+|----------|-----------|-----|
+| Cursor | `alwaysApply: true` | **≤ 3** |
+| Claude | rules **without** `paths:` | **ровно 3** |
+
+**Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
+
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
+
+## Meta / author rules
+
+Rules for preset authors (`preset-layering`, `preset-twin-sync`, …):
+
+- **Never** `alwaysApply: true` on consumer installs.
+- Cursor: `globs` limited to `packages/ai-rules/presets/**` (and dogfood `.cursor/**` where useful).
+- Claude: `paths:` limited to `packages/ai-rules/presets/**` (and `.claude/**` dogfood if present).
+
+## Heavy workflows
+
+Orchestrator, feature-delivery, code-review, post-change gates, domain globs — **requestable / paths**, not always-on.
+
+## Verifier
+
+build-verifier **FAIL** if alwaysApply / session-start count exceeds 3 (Claude count **excludes `**/README.md`**), or if a `preset-*` meta rule is marked always-on.

package/presets/cursor/php-laravel/rules/preset-twin-sync.mdc

@@ -0,0 +1,50 @@
+---
+description: Preset authoring meta-rule (preset-twin-sync)
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-twin-sync.md -->
+
+# Preset twin sync
+
+Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
+
+## Matrix
+
+| Stack | Cursor SoT | Claude derive | Mapping table |
+|-------|------------|---------------|---------------|
+| `next` | `presets/cursor/next/rules/*.mdc` | `presets/claude/next/rules/<topic>/` | **Required** in `claude/next/rules/README.md` |
+| `ios-swift` | `presets/cursor/ios-swift/rules/*.mdc` | `presets/claude/ios-swift/rules/<topic>/` | Keep in `claude/ios-swift/rules/README.md` |
+| `go` | `presets/cursor/go/rules/*.mdc` | `presets/claude/go/rules/<topic>/` | Keep in `claude/go/rules/README.md` |
+| `java` | `presets/cursor/java/rules/*.mdc` | `presets/claude/java/rules/<topic>/` | Keep in `claude/java/rules/README.md` |
+| `mcp-ts` | `presets/cursor/mcp-ts/rules/*.mdc` | `presets/claude/mcp-ts/rules/<topic>/` | Keep in `claude/mcp-ts/rules/README.md` |
+| `php-hexagonal` | `presets/cursor/php-hexagonal/rules/*.mdc` | `presets/claude/php-hexagonal/rules/<topic>/` | Keep in `claude/php-hexagonal/rules/README.md` |
+| `php-laravel` | `presets/cursor/php-laravel/rules/*.mdc` | `presets/claude/php-laravel/rules/<topic>/` | Keep in `claude/php-laravel/rules/README.md` |
+
+## Same-PR checklist
+
+1. Edit Cursor rule first (body + frontmatter).
+2. Update Claude twin: body + `paths:` (from Cursor `globs:` / requestable triggers); drop `alwaysApply`.
+3. Update mapping table row if stem/path changed.
+4. If body embeds core (`<!-- shared-core: … -->`), sync core consumers across stacks when core changed.
+
+## Twin depth
+
+- **Domain** rules: ≥15 body lines (FAIL if thin without documented alias reason).
+- **Thin aliases** (`agent-team-intake`, `technical-retro`): may be shorter (soft) if they only point to a command/skill.
+
+## Severity (build-verifier)
+
+- **next:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **ios-swift:** missing Claude twin for a changed Cursor rule → **FAIL**.
+- **go:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift; mapping table required).
+- **java:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go; mapping table required).
+- **mcp-ts:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java; mapping table required).
+- **php-hexagonal:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts; mapping table required).
+- **php-laravel:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts / php-hexagonal; mapping table required).
+
+Dogfood: sync packages → root `.cursor/` after Cursor SoT changes (not the reverse). Use `packages/ai-rules/scripts/sync-dogfood-cursor.sh`.

package/presets/cursor/php-laravel/rules/reference-features.mdc

@@ -0,0 +1,42 @@
+---
+description: Reference paths for Laravel layout (dogfood/php-laravel)
+globs:
+  - "**/Http/**/*"
+  - "**/Actions/**/*"
+  - "**/Models/**/*"
+  - "**/routes/**/*"
+alwaysApply: false
+---
+
+<!-- shared-core: architecture/reference-features.template.md -->
+
+# Reference features (Laravel)
+
+Canonical layout matches `dogfood/php-laravel/` (consumer repos may rename; prefer the same shapes). Default = flat Laravel `app/`.
+
+| Area | Example path | Glob hint |
+|------|--------------|-----------|
+| Controllers | `app/Http/Controllers/` | `**/Http/Controllers/**` |
+| Form Requests | `app/Http/Requests/` | `**/Http/Requests/**` |
+| Actions | `app/Actions/` | `**/Actions/**` |
+| Models | `app/Models/` | `**/Models/**` |
+| Policies | `app/Policies/` | `**/Policies/**` |
+| Providers | `app/Providers/` | `**/Providers/**` |
+| Jobs / Events | `app/Jobs/`, `app/Events/` | `**/Jobs/**`, `**/Events/**` |
+| Routes | `routes/api.php` | `**/routes/**` |
+| Feature tests | `tests/Feature/` | `**/tests/Feature/**` |
+| Unit tests | `tests/Unit/` | `**/tests/Unit/**` |
+
+## Living conventions
+
+Post-init gotchas / patterns / decisions: **`.cursor/team/conventions.md`** (and the twin tool path if both Cursor and Claude are installed). Consumer-owned; not always-on. See root `AGENTS.md` § Living conventions.
+
+## Dogfood scenarios
+
+1. `/task` new write endpoint — Form Request → Policy → Action → Model → Feature test (`dogfood/php-laravel`).
+2. Validation / 403 mapping — debugger + Feature test on Form Request / Policy.
+3. Async side effect — Job or Event on create with `Bus::fake` / `Event::fake`.
+4. OpenAPI drift — api-contract-reviewer (optional; not a required delivery gate).
+5. Secrets in logs — security-reviewer + `security-php`.
+
+Init (maintainer): `node packages/ai-rules/bin/cli.js init cursor --preset php-laravel --cwd dogfood/php-laravel` — do not commit generated `.cursor/` into the sample unless the team decides otherwise.

package/presets/cursor/php-laravel/rules/routes-api.mdc

@@ -0,0 +1,32 @@
+---
+description: Laravel routes (api.php / web.php) and middleware wiring
+globs:
+  - "**/routes/**/*"
+  - "**/bootstrap/app.php"
+alwaysApply: false
+---
+
+
+# Routes (API / web)
+
+- Prefer `routes/api.php` for JSON APIs and `routes/web.php` for session/cookie web — follow the target Laravel version's routing layout (`bootstrap/app.php` on Laravel 11+).
+- Route → controller method (or invokable); keep closures only for trivial health/ping already used by the repo.
+- Apply auth / throttle / middleware groups at the **route** layer (`auth:sanctum`, `auth:api`, etc. as already configured).
+- Name routes when neighbors name them (`->name('todos.store')`); keep URI style consistent (`/api/todos` vs versioned `/api/v1/...`).
+- Resource routes (`Route::apiResource`) OK when CRUD matches; otherwise explicit verbs.
+
+## Structure
+
+- Feature-local route files only if the repo already splits (`routes/api/todos.php` required from `api.php`).
+- Do not register business logic in route files.
+
+## Testing
+
+- Feature tests hit named URIs or `route('…')` helpers matching production paths.
+- Assert middleware (401/403) when AuthZ is in scope.
+
+## Forbidden
+
+- Fat closures with Eloquent / Actions inlined in `routes/*.php`.
+- Mixing Blade view routes into API delivery tasks without AC.
+- Requiring Next/Playwright route conventions — Laravel only.

package/presets/cursor/php-laravel/rules/security-php.mdc

@@ -0,0 +1,61 @@
+---
+description: Security baseline for Laravel backends (authz, CSRF, tokens, mass assignment)
+globs:
+  - "**/Http/**/*"
+  - "**/routes/**/*"
+  - "**/Policies/**/*"
+  - "**/Models/**/*"
+  - "**/Jobs/**/*"
+  - "**/*Job.php"
+  - "**/config/**/*"
+  - "**/.env*"
+alwaysApply: false
+---
+
+
+# Security (Laravel / PHP)
+
+Baseline for review and implementation. Prefer existing repo auth stack (Sanctum / session / Passport) — do not invent a second one. Livewire/Inertia are **not** required by this preset.
+
+## Mass assignment / input
+
+- Validate untrusted input via **Form Requests**.
+- Persist only from `$request->validated()` or `$request->safe()->only([...])` — never raw `$request->all()` into `create` / `update` / `fill`.
+- Keep `$fillable` / `$guarded` tight on user-facing models. **FAIL** if mass-assignable fields include roles, ownership, or other privilege flags without explicit authorization.
+
+## Authorization
+
+- Authorize via **Policies** / `Gate` (Form Request `authorize()`, controller `$this->authorize()`, or route middleware) — not ad-hoc role string checks scattered in Actions.
+- **FAIL** if a mutating or sensitive read path skips Policy/Gate when neighbors authorize the same resource.
+
+## CSRF
+
+- **Sanctum SPA cookie/session auth requires CSRF** (and the web/cookie middleware stack). Do not disable CSRF for SPA cookie routes.
+- **Bearer-token APIs** (personal access tokens, API tokens without session cookies) are typically CSRF-exempt — follow `VerifyCsrfToken` / middleware already in the repo; do not invent blanket CSRF for pure token APIs.
+
+## Rate limiting
+
+- Public and login/register/password-reset endpoints need rate limiting (`RateLimiter`, `throttle` middleware, or Fortify/Breeze defaults). **FAIL** if new public auth endpoints ship without a throttle when neighbors throttle similar routes.
+
+## API tokens (when Sanctum / tokens are used)
+
+- Issue tokens with least-privilege **abilities**; set expiry when the repo pattern supports it; revoke on logout / compromise / rotation.
+- Never log raw tokens, store them only as the framework expects (hashed), and do not return full token values after first issuance unless that is the product flow.
+
+## Production / secrets / config
+
+- Production: `APP_DEBUG=false`. Secrets from env / secret manager — never commit keys, tokens, or `.env` with credentials.
+- `APP_KEY`, DB credentials, mail tokens — env only; **fail closed** when misconfigured in production.
+- Distinguish public vs secret config fields. Static analysis / secret scanners: run only if the repo/CI already wires them.
+
+## Queued jobs
+
+- Authorize (or re-check entitlement) **at execution time** in `handle()` — do not trust dispatch-time auth alone for sensitive work.
+- Queue only **minimal serializable payloads** (IDs / scalars). See `jobs-queues` for constructor vs `handle()` DI.
+
+## Data / queries / logs (brief)
+
+- Prefer parameterized Eloquent / query builder — no string-concat SQL with user input.
+- Minimize PII in logs; redact passwords, tokens, and secrets.
+- File uploads (when present): validate mime/size, store outside the web root or via the repo's disk pattern, never trust client filenames as paths.
+- Blade/XSS (when server views exist): escape by default (`{{ }}`); use `{!! !!}` only with a documented trusted source.

package/presets/cursor/php-laravel/rules/service-providers.mdc

@@ -0,0 +1,31 @@
+---
+description: Laravel Service Providers and container wiring
+globs:
+  - "**/Providers/**/*"
+  - "**/bootstrap/providers.php"
+alwaysApply: false
+---
+
+
+# Service Providers
+
+- Providers **wire** the container: bindings, singletons, interface → implementation, config publishing — **no business rules**.
+- Prefer constructor injection into Actions/Controllers; bind interfaces only when the repo already uses them.
+- Register policies via `AuthServiceProvider` / `Gate::policy` / auto-discovery as Laravel version + repo already do.
+- Keep `boot()` side effects minimal (observers, macros) and match existing patterns.
+- Laravel 11+: respect `bootstrap/providers.php` / application builder — do not invent a parallel registration path.
+
+## Forbidden
+
+- Eloquent queries / use-case orchestration inside providers.
+- Hard-coding environment secrets in provider source (use `config()` / env).
+- Registering routes that belong in `routes/*.php` unless the repo already registers package routes that way.
+
+## Testing
+
+- Prefer Feature tests that resolve bindings via the app container rather than unit-testing provider methods in isolation.
+- When adding an interface binding, assert the concrete resolves in a Feature or container test if neighbors do.
+
+## Related
+
+- Actions/Services consume bindings: `actions-services`; Policies: `policies-authorization`.

package/presets/cursor/php-laravel/rules/technical-retro.mdc

@@ -0,0 +1,16 @@
+---
+description: Technical retro alias — use /technical-retro command
+alwaysApply: false
+---
+
+<!-- shared-core: review/technical-retro.md -->
+
+# Техническое ретро — rule alias
+
+Полный сценарий (включая блок **«Работа агентов»** для slug из team tasks) — в slash-команде:
+
+**`commands/technical-retro.md`** → `/technical-retro`
+
+When a task has `metrics.json`, use the local aggregation script and state the cohort, sample size, incomplete artifacts, attribution confidence, active attempt duration, and human-gate wait separately. Do not score malformed artifacts or gate wait as agent work.
+
+Используй rule только если command недоступен. Не дублируй содержимое command в ответе — следуй command-файлу и skill `technical-retro`.

package/presets/cursor/php-laravel/rules/tests-e2e.mdc

@@ -0,0 +1,36 @@
+---
+description: Optional end-to-end / smoke tests for Laravel APIs
+globs:
+  - "**/tests/E2E/**/*"
+  - "**/tests/e2e/**/*"
+  - "**/*E2ETest.php"
+  - "**/*SmokeTest.php"
+alwaysApply: false
+---
+
+# E2E / smoke tests (optional)
+
+- Prefer **Feature tests** + `integration-test-*` for API contracts; treat e2e/smoke as a thin optional layer.
+- Smoke may hit a running `php artisan serve` / container when the repo already has that harness.
+- Keep scenarios few and stable: health/ready, one happy-path create — not a second unit suite.
+- Place under `tests/E2E/` or `*SmokeTest.php` when the repo uses those names.
+
+## Boundary vs Feature
+
+| Layer | Typical scope |
+|-------|----------------|
+| Feature / integration | In-process HTTP kernel + DB — **default** for delivery |
+| E2E / smoke | Process or network boundary — optional |
+
+If the repo only has `tests/Unit` + `tests/Feature`, do **not** invent a separate e2e framework.
+
+## Non-goals
+
+- Playwright browser e2e, XCUITest, Blade/Livewire browser suites, or accessibility-reviewer — **out of this preset**.
+- Mandating Dusk if the repo only has Feature tests.
+
+## Related
+
+- Feature depth: `tests-integration` + `integration-test-*`.
+- Sample: `dogfood/php-laravel` + `php artisan test`.
+- Gates: `post-change-test` / `php-tooling` — never yarn lint or browser stacks.

package/presets/cursor/php-laravel/rules/tests-integration.mdc

@@ -0,0 +1,33 @@
+---
+description: Feature/integration testing conventions for Laravel APIs
+globs:
+  - "**/tests/Feature/**/*"
+  - "**/tests/Integration/**/*"
+  - "**/*FeatureTest.php"
+  - "**/*IT.php"
+alwaysApply: false
+---
+
+
+# Feature / integration tests
+
+- Laravel **Feature** tests ≈ integration: HTTP kernel + DB (SQLite in-memory / file preferred).
+- Prefer `RefreshDatabase` / repo harness — do not invent a new DB stack.
+- Keep pure Action logic in Unit tests when valuable; Feature proves route → validation → AuthZ → persistence.
+- Agents: `integration-test-planner` → `generator` → `healer`; skill `integration-testing`.
+
+## Scope
+
+- API create/update/delete happy paths + 422/403 envelopes.
+- Policy denial; Form Request validation; Job/Event fakes when async is in scope.
+- Migration + factory fixtures matching production schema.
+
+## Forbidden
+
+- Requiring Playwright, XCUITest, or yarn `lint:js`/`lint:css` as Laravel gates.
+- Turning every unit case into a full Feature boot when a unit fake suffices.
+
+## Related
+
+- After edits: `post-change-test` (+ `php-tooling`) → `php artisan test`.
+- Unit: `tests-unit`; optional smoke: `tests-e2e`.

package/presets/cursor/php-laravel/rules/tests-unit.mdc

@@ -0,0 +1,33 @@
+---
+description: Unit testing conventions for Laravel Actions and pure PHP
+globs:
+  - "**/tests/Unit/**/*"
+  - "**/tests/unit/**/*"
+  - "**/*Test.php"
+alwaysApply: false
+---
+
+
+# Unit tests
+
+- Prefer **PHPUnit** (or **Pest** if already in repo/CI); clear arrange/act/assert.
+- Actions/Services: mock collaborators when pure enough — no full HTTP kernel required.
+- Prefer fakes over heavy mocking when simple; Mockery only if the repo already uses it.
+- Prefer data providers / Pest datasets when covering multiple cases.
+- Skip Feature / integration files under `tests/Feature` — those use `tests-integration`.
+
+## Scope
+
+- Action logic with faked Eloquent/repos; pure helpers; custom casts when non-trivial.
+- Do not boot the full application for a pure unit case unless the repo's unit harness already does.
+
+## Forbidden smells
+
+- Hitting real HTTP routes in Unit tests (use Feature tests).
+- Brittle tests on private controller internals without need.
+- Requiring Playwright / browser stacks.
+
+## Naming
+
+- `CreateTodoTest` / `TodoPolicyTest` (or Pest `describe`/`it` if that is the repo style).
+- Match PHPUnit/Pest patterns CI already uses.

package/presets/cursor/php-laravel/skills/README.md

@@ -0,0 +1,5 @@
+# Skills (preset php-laravel)
+
+8 skills: `feature-delivery`, `unit-testing`, `integration-testing`, `ci-investigation`, `debug-investigation`, `code-review`, `technical-retro`, `write-adr`.
+
+No `playwright-e2e` / `xcuitest-e2e` / `react-performance`.

package/presets/cursor/php-laravel/skills/ci-investigation/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: ci-investigation
+description: Investigates failing CI checks on PRs and branches — composer test / vendor/bin/phpunit (Pest if present), optional PHPStan/Psalm, integration, preset-structure — with local reproduction and minimal fixes. Use when CI is red or for ci-fix pipeline tasks.
+---
+
+# CI investigation (PHP)
+
+1. Identify job + log excerpt.
+2. Reproduce locally with the same commands.
+3. Minimal fix; for ai-rules preset PRs run `yarn check:preset-structure`.
+4. Do not treat Playwright/xcodebuild/`lint:js` as default PHP gates.

package/presets/cursor/php-laravel/skills/code-review/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: code-review
+description: Reviews pull requests and branch diffs for Laravel services using architecture, HTTP, Actions/Services, Eloquent, Policies, and testing standards. Use when the user asks for review or when code-reviewer runs.
+---
+
+# Code review (Laravel)
+
+1. Diff-first; load `code-review-mr.mdc` + Laravel domain rules (`architecture-boundaries`, `http-layer`, `form-requests`, `actions-services`, `eloquent-persistence`, `service-providers`, `policies-authorization`).
+2. Check layer leaks (fat controllers, Form Requests in Models, AuthZ outside Policies), Provider purity, Feature/Unit tests, security-sensitive bits.
+3. **Reuse lens:** flag new helpers that duplicate existing packages/utilities; prefer shared Actions/Services over copy-paste.
+4. **Efficiency lens:** N+1 Eloquent, missing eager loads, unbounded queues, hot-path bloat, missing timeouts on HTTP clients.
+5. Write `review.md` using the output contract below.
+
+## Output
+
+- Each finding: **`path:line`** — problem — impact — concrete fix direction.
+- Severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- End with a verdict line: **`Safe to merge | needs changes | reject`**.
+- Map agent status: Safe to merge → `completed`; needs changes / reject → `changes_requested`.
+
+Never require iOS/Next-only gates (XCUITest, Playwright, `lint:js`).
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/php-laravel/skills/debug-investigation/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: debug-investigation
+description: Investigates bugs, failing tests, and unexpected behavior in PHP services with runtime evidence before applying minimal fixes. Use for bugfix tasks, debugger agent runs, or regressions.
+---
+
+# Debug investigation (PHP)
+
+1. Capture failing `composer test` / `vendor/bin/phpunit` / logs / stack traces.
+2. Hypothesize layer (domain vs adapter vs wiring).
+3. Minimal fix + regression test when appropriate.
+4. Document in `debug-report.md`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/php-laravel/skills/feature-delivery/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: feature-delivery
+description: Delivers Laravel backend features end-to-end across routes, Form Requests, Policies, Actions/Services, Eloquent, Jobs/Events, tests, and post-change-test validation. Use when implementing or extending a feature, especially through /task or feature-developer.
+---
+
+# Feature Delivery (Laravel)
+
+1. Read brief, AC, and decomposition.
+2. Follow `feature-delivery-workflow.mdc` + `reference-features.mdc`: routes → Form Request/Policy → Action/Service → Eloquent → Controller/Resource → optional Job/Event → tests.
+3. Wire bindings only in Service Providers when needed.
+4. Add Feature tests for HTTP/DB paths; Unit tests for non-trivial Actions.
+5. After PHP edits: **invoke** `post-change-test.mdc` (+ `php-tooling.mdc`) → `php artisan test` / `composer test`.
+
+## Do / Don't
+
+- **Do** keep controllers thin; validate at Form Requests; authorize via Policies.
+- **Don't** put SQL/business rules in controllers or HTTP types in Models/Actions.
+- **Don't** use Playwright, XCUITest, Blade/Livewire a11y, or yarn lint as this stack's gate.
+
+## Scope discipline
+
+Implement only the current AC / decomposition task. Clarify ambiguity before coding; do not add unrelated hardening or drive-by refactors. See `feature-developer` → **Zero improvisation**.
+
+## Handoff
+
+Summarize by layer + validation. Update `.cursor/team/tasks/<slug>/status.json`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/php-laravel/skills/integration-testing/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: integration-testing
+description: Plans, generates, and heals Laravel Feature/integration tests (HTTP kernel, DB fixtures, Job/Event fakes). Use for integration-test-* agents or Feature coverage.
+---
+
+# Integration testing (Laravel)
+
+1. Read `tests-integration` / `tests-e2e` rules and task brief.
+2. Prefer Feature tests through the HTTP kernel (`$this->postJson` / actingAs); DB via `RefreshDatabase` / factories; fake external HTTP and `Bus::fake` / `Event::fake` when async is in scope.
+3. Use CI job split if the repo already does.
+4. Do not introduce Playwright or XCUITest.
+
+## Agents
+
+`integration-test-planner` → `integration-test-generator` → `integration-test-healer` as needed.